Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Can't Get It Working

    Scheduled Pinned Locked Moved Problems Installing or Upgrading pfSense Software
    29 Posts 7 Posters 5.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B Offline
      bluegrass
      last edited by

      Ok, I'm at my wits end with PFSense. I've been trying to get it working on my old desktop since February!

      I have an eMachines EL1200-O5W that I converted into a PFSense box by adding a Rosewell RNG-407 dual port NIC and a 40GB HDD.

      I installed PFSense 2.1 on it and for the last 3 months I haven't been able to get it working. In fact I keep locking myself out of the web interface somehow and have to revert to factory settings to get back in.

      I'm using the PCs stock ethernet port as the WAN and have my cable modem connected to it. The 2 ports on the NIC are for my wireless access point and my web server. I'm using my main desktop PC as a place saver for the web server while I configure the firewall.

      I set the WAN as DHCP and it's getting an IP from the modem, I set the 2 LAN ports to DHCP , no gateway and the IPs to 192.168.2.1 and 192.168.2.2 respectivly. I gave LAN 1 a range of 192.168.2.10-49 and LAN 2's range is 192.168.2.50-99. At this point I can access the web configurator but not the internet.

      So from this point on, I'm lost.

      1 Reply Last reply Reply Quote 0
      • GruensFroeschliG Offline
        GruensFroeschli
        last edited by

        @bluegrass:

        I set the 2 LAN ports to DHCP , no gateway and the IPs to 192.168.2.1 and 192.168.2.2 respectivly. I gave LAN 1 a range of 192.168.2.10-49 and LAN 2's range is 192.168.2.50-99.

        This is your problem.
        You can not have the same subnet on two interfaces (unless they are bridged).
        Set
        192.168.2.1/24 to LAN1
        192.168.3.1/24 to LAN2
        and everything will work.

        We do what we must, because we can.

        Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

        1 Reply Last reply Reply Quote 0
        • johnpozJ Offline
          johnpoz LAYER 8 Global Moderator
          last edited by

          " I set the 2 LAN ports to DHCP , no gateway and the IPs to 192.168.2.1 and 192.168.2.2 respectivly"

          How are you setting lan ports to dhcp and expecting to set a static IP on them as another thing even if they were in different segments.  If you don't want to use a /24 you seem to need 50 IPs on each so you could use a /26

          192.168.2.0/26
          Set pfsense to 192.168.2.1
          192.168.2.0 - 192.168.2.63

          192.168.2.64/26
          Set pfsense to 192.168.2.65
          192.168.2.64 - 192.168.2.127

          Also what network is on your wan side.. Needs to be different than your lan as well.  Vs double natting - pfsense is designed to take the place of your nat router - can you not just give pfsense public IP.. set your isp device to bridge mode.

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • stephenw10S Offline
            stephenw10 Netgate Administrator
            last edited by

            @bluegrass:

            I've been trying to get it working on my old desktop since February!

            I admire your persistence.  ;)

            I agree with John and GF.
            I assume you mean you're running DHCP servers on your internal ports.
            You haven't said what subnets you're running but assuming they're /24 you need to change something.
            Is your WAN address a public IP?

            Steve

            1 Reply Last reply Reply Quote 0
            • B Offline
              bluegrass
              last edited by

              To GruensFroeschli, thanks, I'll give that a try.

              johnpoz said: How are you setting lan ports to dhcp and expecting to set a static IP on them as another thing even if they were in different segments.  If you don't want to use a /24 you seem to need 50 IPs on each so you could use a /26

              Well I'm new to this, so cut me some slack. I don't need 50 IPs on each, I just didn't know how to set it up correctly.

              stephenw10, yes my subnets are /24 but I know I need to lower the internal IP range, just not sure how much.

              My WAN address is the IP given by my ISP's modem so I guess it's public.

              SO here's what I think I've learned so far

              1. I need to put one of my LAN ports on a different subnet

              2. I need to lower my IP range on each LAN port

              3. My LAN ports need to be set to static, not DHCP.

              Did I miss anything?

              1 Reply Last reply Reply Quote 0
              • stephenw10S Offline
                stephenw10 Netgate Administrator
                last edited by

                If you do 1. there is no need to do 2.

                Yes your LAN ports should be set to type 'static'. If you want clients behind then to connect automatically you need to enable a DHCP server on each port. The default configuration has DHCP enabled on 'LAN' already.
                You will also need to add firewall rules to the second LAN to allow traffic.

                Steve

                1 Reply Last reply Reply Quote 0
                • B Offline
                  bluegrass
                  last edited by

                  @stephenw10:

                  If you do 1. there is no need to do 2.

                  Yes your LAN ports should be set to type 'static'. If you want clients behind then to connect automatically you need to enable a DHCP server on each port. The default configuration has DHCP enabled on 'LAN' already.
                  You will also need to add firewall rules to the second LAN to allow traffic.

                  Steve

                  Do I need to add firewall rules to the first port too?

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S Offline
                    stephenw10 Netgate Administrator
                    last edited by

                    When you first configure pfSense the first interface is labelled WAN and the second is labelled LAN. Subsequent interfaces are labelled OPT1, OPT2, OPT3 etc. I point this out because yo can rename the interfaces anything you want and you have referred to both your internal interfaces as LAN. The first LAN interface has a firewall rule setup by default to allow out all traffic originating from that subnet, the "Default allow LAN to any rule". So you do not need to add any further rules to the LAN interface in order to get internet access. If you look at Firewall: Rules: LAN(tab) in the webgui you will see it as well as a rule to prevent you getting locked out of the webgui.

                    Only the LAN has that default rule. All other traffic must be explicitly allowed by rules you've added.

                    Steve

                    1 Reply Last reply Reply Quote 0
                    • B Offline
                      bluegrass
                      last edited by

                      @stephenw10:

                      When you first configure pfSense the first interface is labelled WAN and the second is labelled LAN. Subsequent interfaces are labelled OPT1, OPT2, OPT3 etc. I point this out because yo can rename the interfaces anything you want and you have referred to both your internal interfaces as LAN. The first LAN interface has a firewall rule setup by default to allow out all traffic originating from that subnet, the "Default allow LAN to any rule". So you do not need to add any further rules to the LAN interface in order to get internet access. If you look at Firewall: Rules: LAN(tab) in the webgui you will see it as well as a rule to prevent you getting locked out of the webgui.

                      Only the LAN has that default rule. All other traffic must be explicitly allowed by rules you've added.

                      Steve

                      Yeah, my second LAN is labeled OPT1. Specifically, what do I need to do to OPT1 to get it set up like the LAN port?

                      1 Reply Last reply Reply Quote 0
                      • C Offline
                        cthomas
                        last edited by

                        You'll need to add a firewall rule to OPT1 to permit traffic to egress that network;

                        PASS
                        IPv4
                        source "OPT1 net"
                        source port ANY
                        destination ANY
                        destination port ANY

                        Keep in mind that LAN and OPT1 will be able to communicate because both the LAN and OPT1 have rules that "Permit ANY".  If you want to block this, you'll need to add a rule on LAN that says 'BLOCK LAN net to OPT1 net', and on OPT1 that says 'BLOCK OPT1 net to LAN net'.  These 'Block' rules will need to be placed ABOVE the Permit ANY rule.

                        -ct

                        1 Reply Last reply Reply Quote 0
                        • D Offline
                          divsys
                          last edited by

                          You can probably get away with going into Firewall->Rules->LAN and clicking on the "+" besides the  "Default allow LAN to any rule", which will copy that rule and make a new one you can change. It will take you into the details and you can simply change the Interface from LAN to OPT1.

                          Save it, Apply changes, then your good to go.

                          Edit:
                          As per cthomas, if you want to BLOCK traffic, you can add further rules to LAN,OPT1 or both.

                          -jfp

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S Offline
                            stephenw10 Netgate Administrator
                            last edited by

                            @divsys:

                            You can probably get away with going into Firewall->Rules->LAN and clicking on the "+" besides the  "Default allow LAN to any rule", which will copy that rule and make a new one you can change.

                            Ah, it's never occurred to me that you could do that. You learn something everyday.  :)
                            However you will also have to change the source address from LAN net to OPT1 net.

                            Steve

                            1 Reply Last reply Reply Quote 0
                            • D Offline
                              divsys
                              last edited by

                              Yes, the source address change is one of those "oh yeah, don't forget to change that too…" I remember when I'm  looking at the rule sheet - not while I'm typing  :(

                              Thanks for the catch  :)

                              -jfp

                              -jfp

                              1 Reply Last reply Reply Quote 0
                              • B Offline
                                bluegrass
                                last edited by

                                Ok, I'm able to access the internet through both LAN ports on my firewall HOWEVER, I can also access the web GUI on either port using either IP address. No matter which LAN port I'm on I can sign in to the GUI with 192.168.2.1 and 192.168.3.1

                                That shouldn't be happening, right?

                                1 Reply Last reply Reply Quote 0
                                • stephenw10S Offline
                                  stephenw10 Netgate Administrator
                                  last edited by

                                  That is the expected behaviour if you have 'allow any' rules on each LAN interface.

                                  Steve

                                  1 Reply Last reply Reply Quote 0
                                  • B Offline
                                    bluegrass
                                    last edited by

                                    I tried changing the "allow any" rule to "allow WAN subnet to LAN1 subnet" but then I can't access anything over that port. I put back the allow any rule and it works but I can also access both ports from either again.

                                    1 Reply Last reply Reply Quote 0
                                    • D Offline
                                      divsys
                                      last edited by

                                      @bluegrass:

                                      I tried changing the "allow any" rule to "allow WAN subnet to LAN1 subnet" but then I can't access anything over that port. I put back the allow any rule and it works but I can also access both ports from either again.

                                      If you're just trying to stop LAN from seeing OPT1 (and vice versa), you can add a LAN1 rule:

                                      "Allow LAN to NOT OPT1 subnet"

                                      And similarly on OPT1

                                      "Allow OPT1 to NOT LAN"

                                      Depends on what you're trying to acheive

                                      -jfp

                                      1 Reply Last reply Reply Quote 0
                                      • stephenw10S Offline
                                        stephenw10 Netgate Administrator
                                        last edited by

                                        Yep. Or you can explicitly block access to the OPT1 interface address from the LAN subnet with a block rule placed above the 'allow any' rule. Then you can still access devices on OPT1 from LAN.

                                        1 Reply Last reply Reply Quote 0
                                        • B Offline
                                          bluegrass
                                          last edited by

                                          I'm not sure if I'm doing this right so here's a screen cap of what I did. There was no change.

                                          fhgf.JPG
                                          fhgf.JPG_thumb

                                          1 Reply Last reply Reply Quote 0
                                          • johnpozJ Offline
                                            johnpoz LAYER 8 Global Moderator
                                            last edited by

                                            So you want to BLOCK going anywhere but that lan segment?  That is what that rule would do.

                                            Post your lan rules so we can see exactly what other rules you have in place, etc.  That rule by itself would block everything but the lan segment.  So you would not be able to go to the internet..  Is that what your after?

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.